EUVD-2026-96437
GHSA-hq6c-2hxp-47rv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running SiteVault <= 1.5.19
-
DeliverySend crafted request to vulnerable plugin endpoint
-
ExploitInject attacker-controlled PHP code (CWE-94)
-
ExecutionExecute arbitrary code as web server
-
ImpactCompromise WordPress site and data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The only prerequisite is that the target WordPress site has the SiteVault - Backup, Restore, Migration & Cloning plugin (vendor: royal_plugins) installed and active at version 1.5.19 or earlier; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special non-default configuration are required to reach the vulnerable code-injection path. The primary limiting factor is therefore product presence rather than configuration: sites without this plugin, or running a patched version above 1.5.19, are not affected. No platform-specific constraint is indicated beyond a standard WordPress/PHP deployment. |
| Impact | This is a genuine high-priority issue, not a CVSS-inflated paper risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation requiring no user interaction, and CWE-94 (code injection) combined with the 'Unauthenticated RCE' description means a successful attack yields arbitrary code execution with full confidentiality, integrity and availability impact. The 10.0 score is driven partly by S:C (scope change); a more conservative scope assessment still leaves this at ~9.8, so severity is not materially overstated. However, several real-world risk signals are MISSING from the input: there is no EPSS exploitation-probability score, no CISA KEV listing, and no indication of public exploit (POC) code. Per the precision rules, exploitation status is therefore 'no public exploit identified at time of analysis' - this should NOT be read as 'not exploitable', only as 'no confirmed weaponization observed in the provided data.' The dominant mitigating factor is prevalence: this is a specific WordPress backup/migration plugin rather than core infrastructure, so blast radius depends entirely on how many sites run it. Net: for any site running SiteVault <= 1.5.19, treat as urgent (patch/remove immediately); fleet-wide prioritization should weight the limited install base against the trivial, unauthenticated exploitability. |
| Exploit ScenarioDerived | A remote attacker identifies a WordPress site running the SiteVault Backup/Restore/Migration plugin (version <= 1.5.19) and sends a crafted request to the vulnerable plugin endpoint that injects attacker-controlled code (CWE-94), with no login or user interaction required (AV:N/AC:L/PR:N/UI:N). The injected code executes in the PHP context of the web server, giving the attacker arbitrary command execution, full control of the WordPress installation, and access to its database and backup archives. No public exploit code is identified in the provided data, but the low attack complexity makes exploit development straightforward once details are public. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Unauthenticated remote code execution in the WordPress plugin SiteVault - Backup, Restore, Migration & Cloning (royal_plugins) at version 1.5.19 and earlier lets any remote attacker run arbitrary PHP code on an affected site with no login, no special configuration, and no user interaction, yielding CVSS 10.0 / 9.8-class impact. Any WordPress installation with this plugin installed and active is exposed; sites that never installed it, or that have upgraded past 1.5.19, are unaffected. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, but the low complexity and zero prerequisites make this a genuine high-priority issue rather than a CVSS-inflated paper risk, and full site compromise (including database and backup archives) is the realistic outcome of exploitation.
RemediationAI
The provided intelligence does not include an exact patched version number, so the first step is to confirm the fixed release on the Patchstack advisory for this plugin (https://patchstack.com/database/wordpress/plugin/sitevault-backup-restore-migration/vulnerability/wordpress-sitevault-backup-restore-migration-cloning-plugin-1-5-18-remote-code-execution-rce-vulnerability) and upgrade SiteVault - Backup, Restore, Migration & Cloning to the first release above the affected 1.5.19 line; until that version is confirmed, treat every install at 1.5.19 or earlier as compromised-capable and patch immediately. Where an upgrade cannot be applied at once, the highest-value compensating control is to deactivate and remove the plugin entirely, accepting the trade-off that scheduled backups, restores, and migration tooling stop working until a vetted alternative (such as a maintained backup plugin or host-level snapshotting) is in place. If the plugin must stay active, deploy a WAF or web server rule that blocks external requests to the plugin's own paths under /wp-content/plugins/sitevault-backup-restore-migration/ and to any plugin-supplied admin-ajax.php or REST route it registers, understanding that such rules are signature-dependent and may be bypassed if the endpoint naming or encoding changes, and that overly broad blocking of admin-ajax.php will break unrelated plugins. Additional hardening with real trade-offs includes restricting wp-admin and REST access by source IP or behind an authenticated reverse proxy (which locks out legitimate remote administrators and mobile clients) and fronting PHP execution with a hardened php.ini/disable_functions configuration (which can break the plugin's own legitimate file-writing backup operations). Finally, given unauthenticated code execution, hunt for post-exploitation evidence - unexpected PHP files under wp-content/uploads or the plugin directory, new administrative users, modified wp-config.php, or outbound connections from the web server - and rotate WordPress salts, database credentials, and any secrets stored on the host if compromise is suspected.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-94 (Improper Control of Generation of Code / Code Injection) describes the root cause class here: the plugin takes attacker-supplied input and feeds it into a code generation or execution path without adequate validation or escaping. Because the evaluated vector is AV:N/AC:L/PR:N/UI:N, the vulnerable route is reachable over HTTP by an unauthenticated party, and because AC is Low, no race condition, crafted file, or non-default setting is needed to trigger it. The CVSS:3.1 vector supplied by the reporter scores 10.0 using S:C (scope changed), meaning exploitation can escape the vulnerable plugin component and affect resources beyond its security authority; our independent assessment keeps the same C:H/I:H/A:H and PR:N/UI:N but scores S:U, which is the more conservative reading and still lands in the critical band. The affected artifact is the WordPress plugin published by royal_plugins, represented in the CPE data as a wildcard version (cpe:2.3:a:royal_plugins:sitevault_-_backup,_restore,_migration_&_cloning:*), reflecting that the advisory covers the whole release line through 1.5.19 rather than a single build. Functionally, the plugin performs site backup, restore, migration, and cloning operations - functionality that inherently involves writing files and executing code on the host - which is a classic high-value target surface when those privileged operations are reachable without authentication. The reporting source is Patchstack, the WordPress-focused vulnerability database that tracks plugin advisories, and the single reference provided is its advisory page, which should be the authoritative source for the vulnerable and fixed version boundaries.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Unauthenticated network code injection with no user interaction (AV:N/AC:L/PR:N/UI:N) yielding full RCE impact; scope assessed as unchanged (S:U) since execution stays within the WordPress/PHP component, unlike the input's S:C.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Remote Code Execution (RCE) in SiteVault - Backup, Restore, Migration & Cloning <= 1.5.19 versions.
Executive ViewAI
The SiteVault backup, migration, and cloning plugin for WordPress (royal_plugins) contains a maximum-severity flaw in versions 1.5.19 and earlier that lets an outside attacker execute arbitrary code on any site where the plugin is installed and active, with no credentials, configuration changes, or user interaction required. Because this plugin handles site backups, a successful attack would hand over the site, its database, and its stored backup archives, turning a single plugin into a full compromise of the organization's public web presence and any customer or employee data resident there. Leadership should treat every affected WordPress property as exposed until the plugin is removed or a vendor fix is released, and should note that no public exploit code or confirmed active exploitation was identified at the time of this analysis.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate and remove the SiteVault plugin (royal_plugins) version 1.5.19 and earlier from all WordPress sites; if removal is not immediately possible, deploy WAF/virtual-patching rules to block exploitation attempts, restrict access to plugin endpoints, and monitor logs for signs of intrusion; rotate credentials and verify integrity of backups and databases on any site that ran the plugin.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Exploit-DB